PDA

View Full Version : IRC network = down.


Rizzon
12-19-2004, 17:44
IRC Network is down.

faqall
12-19-2004, 17:51
according to:

http://www.hyperspin.com/publicreport.php?v=cts8eqEhsb8Aokj9sdmQdKoNVvtJimI xMrg7X2%2Bv6OMREj2Xcp6ih4bM%20

its up

(take note they removed the httpd one ;) )

Rizzon
12-19-2004, 17:53
It was down for about 10 minutes

b4sh
12-19-2004, 17:53
another l3 issue again

ChronoCross
12-19-2004, 17:54
It was down for about 10 minutes
perhaps it was only your server. a dos attack. that's what I think.

Rizzon
12-19-2004, 17:55
perhaps it was only your server. a dos attack. that's what I think.


Perhabs, not? gg.

Rizzon
12-19-2004, 17:55
another l3 issue again

Not this time:

4.79.72.46 87% Packet Loss

ChronoCross
12-19-2004, 17:56
we'll until some web users come on and say they are having problems as well it's probably not a L3 issue but rather more dos on the irc network.

faqall
12-19-2004, 17:57
Perhabs, not? gg.

haha, lol :p

mikron15
12-19-2004, 18:00
It was down for about 10 minutes My networks didnt split yet..but lagged to hell

EDIT: checked mrtg graphs..no Ddos on my server

Rizzon
12-19-2004, 18:00
we'll until some web users come on and say they are having problems as well it's probably not a L3 issue but rather more dos on the irc network.

Yes, too bad web users were routed via Cogent, :rolleyes:


6. 130.81.15.14 0.0% 5 7.7 18.3 7.7 24.7 6.3
7. p14-0.core02.jfk02.atlas.cogentco.com 0.0% 5 11.8 19.2 11.8 23.6 4.6
8. p14-0.core02.ord01.atlas.cogentco.com 0.0% 5 37.5 45.2 37.5 55.0 7.2
9. FDC_Servers.demarc.cogentco.com 0.0% 5 39.7 42.4 36.3 47.4 4.4
10. 0.0% 5 36.4 45.1 36.4 51.3 5.5

Photojerk.

GG?

Rizzon
12-19-2004, 18:01
My networks didnt split yet..but lagged to hell

EDIT: checked mrtg graphs..no Ddos on my server

It was because of you :mad: :mad: ;)

psyxakias
12-19-2004, 18:01
Hello,

Indeed there was high packet loss in FDC IRC line for about 6 minutes, not sure if it was Level3 issue or DDoS that saturated the line:

[19-12-2004 11:40] 60 packets transmitted, 0 packets received, 100% packet loss
[19-12-2004 11:41] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:41] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:43] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:44] 60 packets transmitted, 0 packets received, 100% packet loss
[19-12-2004 11:45] 60 packets transmitted, 0 packets received, 100% packet lossEverything is back to normal now.

faqall
12-19-2004, 18:03
is that a script or just a constant ping your using?

Rizzon
12-19-2004, 18:08
is that a script or just a constant ping your using?

Probably a simple perl script that loops ping -c 60 greps output and parses it to file.

psyxakias
12-19-2004, 18:18
It's a bash script in combination with tcp pinger, because ICMPs are filtered from our network. In past, even FDC had temporary blocked ICMPs so I wanted something more accurate (like tcp ping) that won't get affected from ICMP/UDP filters.

mikron15
12-19-2004, 18:23
It was because of you :mad: :mad: ;)
yah, i did it coz u stole my lollipop :mad:

;)

Rizzon
12-19-2004, 18:23
#!/usr/bin/perl

require 5.002;
use Socket;
use Time::HiRes qw(gettimeofday tv_interval);
use Errno qw(ECONNREFUSED EINTR);

sub timeout
{
return;
}

sub ping
{
my($host, $timeout, $count) = @_;
my $iaddr = inet_aton($host) or die "Unknown host: $host\n";
my $proto = getprotobyname('tcp') or die "getprotobyname: $!\n";
my $n = 0;
my $port = 65535;
my $paddr = undef;
my $elapsed = 0;
my $got = 0;

while($n++ < $count || !$count)
{
$paddr = sockaddr_in($port, $iaddr) or
die "getprotobyname: $!\n";

socket(SOCKET, PF_INET, SOCK_STREAM, $proto) or
die "socket: $!\n";

local($SIG{'ALRM'}) = 'timeout';
alarm($timeout);

my $t0 = [gettimeofday];
connect(SOCKET, $paddr);

if ($! == &EINTR)
{
$port--;
}

if ($! == &ECONNREFUSED)
{
$got++;
$elapsed += tv_interval ($t0, [gettimeofday]);
}

close(SOCKET);
}

if ($got)
{
return (($elapsed * 1000) / $got);
}
else
{
return -1;
}
}

print ping($ARGV[1], 5, $ARGV[0]);

b4sh
12-19-2004, 18:42
this is supposed to work on linux right?

faqall
12-19-2004, 18:43
thanks, ill give it a wack later

Rizzon
12-19-2004, 18:57
this is supposed to work on linux right?


Yeah, I will code one for BSD in a sec.

mikron15
12-19-2004, 19:01
Hello,

Indeed there was high packet loss in FDC IRC line for about 6 minutes, not sure if it was Level3 issue or DDoS that saturated the line:

[19-12-2004 11:40] 60 packets transmitted, 0 packets received, 100% packet loss
[19-12-2004 11:41] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:41] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:43] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:44] 60 packets transmitted, 0 packets received, 100% packet loss
[19-12-2004 11:45] 60 packets transmitted, 0 packets received, 100% packet lossEverything is back to normal now.


no its not..itz still going on :/

mikron15
12-19-2004, 19:04
Yeah, I will code one for BSD in a sec. Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at ./ping.pl line 5.
BEGIN failed--compilation aborted at ./ping.pl line 5.

EDIT: OS is FC1

Rizzon
12-19-2004, 19:13
Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at ./ping.pl line 5.
BEGIN failed--compilation aborted at ./ping.pl line 5.

EDIT: OS is FC1

You system admin? :eek:

cpan install Time/HiRes
cpan i \HiRes\

Rizzon
12-19-2004, 20:16
TCP Ping log for *nix:

Install Poink:


su -
cd
wget http://freshmeat.net/redir/poink/37137/url_zip/poink.zip
unzip poink.zip
cd poink
make

Make a script:
pico -w tcpping.sh

#!/bin/sh
echo ' ' >> /var/log/ping.log && /bin/date >> /var/log/ping.log && /root/poink/poink -i 1 -c 30 -t 10 sharktech.net | grep 'transmitted' >> /var/log/ping.log

chmod a+x tcpping.sh

Make a cronjob:

crontab -e

*/5 * * * * /root/poink/tcpping.sh >/dev/null 2>&1

Secure our log file:

touch /var/log/ping.log && chmod 700 /var/log/ping.log


Then tail -f /var/log/ping.log to view network status :)

If you are smart it's fairly easy to run this on linux.

Rizzon
12-19-2004, 20:22
Sample out put:

Sun Dec 19 15:18:05 EST 2004
30 packet(s) transmitted, 30 packet(s) received, 0% packets lost.

Sun Dec 19 15:20:00 EST 2004
30 packet(s) transmitted, 30 packet(s) received, 0% packets lost.

faqall
12-19-2004, 21:32
nice work, thanks a bunch.

edit:

this wouldnt make much sense to use internally would it

Rizzon
12-19-2004, 21:42
nice work, thanks a bunch.

edit:

this wouldnt make much sense to use internally would it

Nope, I'm using that on my home boxen :(

mikron15
12-19-2004, 21:54
TCP Ping log for *nix:
Then tail -f /var/log/ping.log to view network status :)

If you are smart it's fairly easy to run this on linux.
To make life easy, you could also create an alias for viewing the stats:

In ur home directory,

pico .bashrc


Add the following line:
alias show_status='tail -f /var/log/ping.log'

Save and exit
logout and login back and simply tyoe show_status

NOTE: you can always replace the phrase "show_status" ..Just make sure, u dont use a linux reserved keyword


Also, Since the link for poink takes ages to resolve and download...you can grab it from my server.
http://smart-host.us/poink.zip

One more thing that may confuse people..in the code section...
the line " chmod a+x tcpping.sh" is suppose to be typed after saving & exiting pico

mikron15
12-19-2004, 21:55
nice work, thanks a bunch.

edit:

this wouldnt make much sense to use internally would it
You mean pinging a local/internal server in FDC?

mikron15
12-19-2004, 21:59
--- yahoo.ca ping statistics ---
42 packets transmitted, 24 received, 42% packet loss, time 45456ms
rtt min/avg/max/mdev = 161.881/166.862/180.322/3.744 ms, pipe 2


At 5pm EST


traceroute to yahoo.ca (66.218.71.198), 30 hops max, 38 byte packets
1 66.90.82.1 (66.90.82.1) 0.952 ms 0.554 ms 0.414 ms
2 209.120.155.13 (209.120.155.13) 0.563 ms 0.413 ms 0.429 ms
3 4.79.72.41 (4.79.72.41) 111.751 ms 112.866 ms 112.582 ms
4 so-0-3-0.bbr1.Chicago1.Level3.net (4.68.96.37) 113.554 ms * *
5 ge-0-1-0.bbr1.SanJose1.Level3.net (64.159.1.129) 170.354 ms 179.347 ms 183.613 ms
6 so-14-0.hsa3.SanJose1.Level3.net (4.68.114.154) 58.408 ms 58.239 ms 58.188 ms
7 65.57.246.2 (65.57.246.2) 182.192 ms 216.381 ms *
8 ge-1-0-9.msr1.scd.yahoo.com (216.115.101.42) 187.380 ms 159.713 ms ge-0-0-2.msr1.scd.yahoo.com (66.218.64.134) 126.383 ms
9 vl42.bas1-m.scd.yahoo.com (66.218.82.226) 57.944 ms 58.183 ms UNKNOWN-66-218-82-230.yahoo.com (66.218.82.230) 58.106 ms
10 alteon3.68.scd.yahoo.com (66.218.68.12) 58.039 ms 57.995 ms 58.251 ms

Rizzon
12-19-2004, 22:09
Sun Dec 19 17:00:00 EST 2004
30 packet(s) transmitted, 30 packet(s) received, 0% packets lost.

Sun Dec 19 17:05:00 EST 2004
30 packet(s) transmitted, 30 packet(s) received, 0% packets lost.

(Sharktech)

mikron15
12-19-2004, 22:36
Do u mind posting a traceroute to 66.218.71.198

Here's mine at 5:30 pm est:

traceroute to yahoo.ca (66.218.71.198), 30 hops max, 38 byte packets
1 66.90.82.1 (66.90.82.1) 0.560 ms 0.411 ms 0.396 ms
2 209.120.155.13 (209.120.155.13) 0.506 ms 0.590 ms 0.496 ms
3 4.79.72.41 (4.79.72.41) 172.550 ms 172.229 ms 225.226 ms
4 * * so-0-3-0.bbr1.Chicago1.Level3.net (4.68.96.37) 142.955 ms
5 ge-0-1-0.bbr1.SanJose1.Level3.net (64.159.1.129) 198.254 ms 200.029 ms 199.821 ms
6 so-14-0.hsa3.SanJose1.Level3.net (4.68.114.154) 58.814 ms 58.298 ms 58.320 ms
7 * 65.57.246.2 (65.57.246.2) 197.061 ms 197.245 ms
8 ge-1-0-2.msr1.scd.yahoo.com (66.218.82.193) 197.017 ms ge-1-0-9.msr1.scd.yahoo.com (216.115.101.42) 194.008 ms *
9 UNKNOWN-66-218-82-238.yahoo.com (66.218.82.238) 58.134 ms 58.058 ms vl42.bas1-m.scd.yahoo.com (66.218.82.226) 57.888 ms
10 * alteon3.68.scd.yahoo.com (66.218.68.12) 177.868 ms 176.306 ms


Here's the ping stats from second irc box:
--- yahoo.ca ping statistics ---
33 packets transmitted, 25 received, 24% packet loss, time 32350ms
rtt min/avg/max/mdev = 176.671/219.421/242.414/19.026 ms

[CODE]


The problem is outside FDC..mainly on the SanJose and bbr1.Chicago.L3.net routers

Rizzon
12-19-2004, 22:49
Do u mind posting a traceroute to 66.218.71.198

Here's mine at 5:30 pm est:

traceroute to yahoo.ca (66.218.71.198), 30 hops max, 38 byte packets
1 66.90.82.1 (66.90.82.1) 0.560 ms 0.411 ms 0.396 ms
2 209.120.155.13 (209.120.155.13) 0.506 ms 0.590 ms 0.496 ms
3 4.79.72.41 (4.79.72.41) 172.550 ms 172.229 ms 225.226 ms
4 * * so-0-3-0.bbr1.Chicago1.Level3.net (4.68.96.37) 142.955 ms
5 ge-0-1-0.bbr1.SanJose1.Level3.net (64.159.1.129) 198.254 ms 200.029 ms 199.821 ms
6 so-14-0.hsa3.SanJose1.Level3.net (4.68.114.154) 58.814 ms 58.298 ms 58.320 ms
7 * 65.57.246.2 (65.57.246.2) 197.061 ms 197.245 ms
8 ge-1-0-2.msr1.scd.yahoo.com (66.218.82.193) 197.017 ms ge-1-0-9.msr1.scd.yahoo.com (216.115.101.42) 194.008 ms *
9 UNKNOWN-66-218-82-238.yahoo.com (66.218.82.238) 58.134 ms 58.058 ms vl42.bas1-m.scd.yahoo.com (66.218.82.226) 57.888 ms
10 * alteon3.68.scd.yahoo.com (66.218.68.12) 177.868 ms 176.306 ms


Here's the ping stats from second irc box:
--- yahoo.ca ping statistics ---
33 packets transmitted, 25 received, 24% packet loss, time 32350ms
rtt min/avg/max/mdev = 176.671/219.421/242.414/19.026 ms

[CODE]


The problem is outside FDC..mainly on the SanJose and bbr1.Chicago.L3.net routers

No traceroute, but mtr shows ~30% packet loss 10% on FDC and 20% on SanJose L3

faqall
12-19-2004, 23:07
You mean pinging a local/internal server in FDC?

yea, im going to have to have this setup outside of fdc!

psyxakias
12-19-2004, 23:18
yea, im going to have to have this setup outside of fdc!Why not setting it up inside and ping outside (ie google, yahoo, microsoft, cnn, etc) as I do? ;)

Rizzon
12-19-2004, 23:21
Ok better script now, I wanted to monitor two servers without making it too messy ;)

You can now setup multiple cronjobs with simple variable changes. :cool:

tcpping
Usage: tcpping [host] [delay] [count] [timeout] [log file]
Example ./tcpping fdcservers.net 2 10 5 /var/log/tcpping.log


#!/bin/sh

###### Change me #######
poink=/root/poink/poink
########################

host=$1
delay=$2
count=$3
timeout=$4
logfile=$5
if [ "$host" = "-about" ]; then
echo 'Coded by Rizzon for FDC customers.'
exit
fi

if [ "$host" = "" ] || [ "$delay" = "" ] || [ "$count" = "" ] || [ "$timeout" = "" ]; then
echo 'Usage: tcpping [host] [delay] [count] [timeout] [log file]'
echo 'Example ./tcpping fdcservers.net 2 10 5 /var/log/tcpping.log'
exit
else
date=`date`
echo '-' >> $logfile
echo $date 'Pinging ' $host':' >> $logfile && $poink -i $delay -c $count -t $timeout $host | grep 'transmitted' >> $logfile
exit
fi

Rizzon
12-19-2004, 23:43
Ok, I'm done. Here is version with UDP ping too (FDC is having some problems with TCP ping it seems, so you can do udp ping tests now too).

Example:
./tcpping fdcservers.net 1 30 10 /var/log/latency.log udp
./tcpping sharktech.net 1 30 10 /var/log/latency.log tcp

etc..

tcpping:

#!/bin/sh

###### Change me #######
poink=/root/poink/poink
ping=/sbin/ping
########################

###### Sample CJ #######
#*/5 * * * * /usr/bin/tcpping fdcservers.net 1 30 60 /var/log/latency.log udp
#*/5 * * * * /usr/bin/tcpping sharktech.net 1 30 10 /var/log/latency.log tcp
########################
host=$1
delay=$2
count=$3
timeout=$4
logfile=$5
type=$6

if [ "$host" = "-about" ]; then
echo 'Coded by Rizzon for FDC customers.'
exit
fi

if [ "$host" = "" ] || [ "$delay" = "" ] || [ "$count" = "" ] || [ "$timeout" = "" ] || [ "$type" = "" ] || [ "$type" != "udp" ] && [ "$type" != "tcp" ]; then
echo 'Usage: tcpping [host] [delay] [count] [timeout] [log file] [udp/tcp]'
echo 'Example ./tcpping fdcservers.net 1 30 60 /var/log/tcpping.log tcp'
echo 'Example ./tcpping fdcservers.net 1 30 10 /var/log/udpping.log udp'
exit
else

date=`date`

if [ "$type" = "tcp" ]; then
echo -e '--' '\n' $date 'Pinging (TCP)' $host':' '\n ' `$poink -i $delay -c $count -t $timeout $host | grep 'transmitted'` >> $logfile

fi

if [ "$type" = "udp" ]; then
echo -e '--' '\n' $date 'Pinging (UDP)' $host':' '\n ' `$ping -q -n -i $delay -t $timeout -c $count $host | grep 'packet loss'` >> $logfile
fi

exit
fi

mikron15
12-20-2004, 00:11
No traceroute, but mtr shows ~30% packet loss 10% on FDC and 20% on SanJose L3
Bummer, Did yah get in touch with L3 and asked them whats up?

Rizzon
12-20-2004, 00:47
Current status report:

--
Sun Dec 19 19:45:00 EST 2004 Pinging (UDP) fdcservers.net:
30 packets transmitted, 30 packets received, 0% packet loss
--
Sun Dec 19 19:45:00 EST 2004 Pinging (TCP) sharktech.net:
30 packet(s) transmitted, 30 packet(s) received, 0% packets lost.
--
Sun Dec 19 19:45:00 EST 2004 Pinging (UDP) IRCNETWORKBOX:
30 packets transmitted, 29 packets received, 3% packet loss

psyxakias
12-20-2004, 09:35
Rizzon, first of all I have to congragulate you for this nice script you offered publicly to all forum members. Although I didn't have the time to test it, the code seems nice and organized. Good Job. Anyway, I'd like to give you a few comments:

1. I really think you should create a thread in HOW-TO category with your tutorial/script because anyone will easily get confused following this thread. What do you think?

2. Comparing packetloss between 2 different IPs with different protocols (TCP, UDP) is not that good idea. At your above example, it showed sharktech had 0% packetloss while fdc-ircnetwork had 3%. That is quite non-logical, unless fdc's switches were dropping packets (something very rare) or that ircnetworkbox was too busy/overloaded/attacked or my theory is that it may had to do with packets prioritization due to different protocols. So I'd recommend to perform tests using the same protocol, either TCP either UDP.

3. Although we have our own internal network topology (firewalls, switches, router) in sharktech, we still are passing through FDC's core-router so comparing us with FDC won't make any real difference unless there are DDoS attacks coming. In that case, 2 attacked servers (one in fdc and one in sharktech) will have huge difference in packetloss/downtime because the one will be firewalled while the other unfirewalled.

4., A verizon IP (151.202.67.XXX) that keeps trying to connect/scan closed ports on our server(s) every 5 minutes since yesterday is yours? Since I blocked it, it's hammering us every 1-2 seconds (all the time, not every 5 minutes) which is quite unfriendly and may be caused due to the high timeout (10 secs if I'm correct) you've setted on your script. The reason I'm mentioning this is not to blame you about something, but maybe to improve the script to not hammer if someone blocks it. Also, I have to admit that I don't really like unauthorized port scanning/monitoring so I'd appreciate if it's yours to stop it. However, if that IP is not related to you, please nevermind.

Once again, good job and special thanks for your valuable help on this forum.


mikron15, bummer has already said that we'll be moved in a different router at 22-23rd of this month that will be connected to multiple OC-192's. So I don't think there is any real reason to get in touch with L3 as there was no complete outage, but just the usual packetloss issues we have been facing since FDC moved from Williams to Level3.

Rizzon
12-20-2004, 16:51
Rizzon, first of all I have to congragulate you for this nice script you offered publicly to all forum members. Although I didn't have the time to test it, the code seems nice and organized. Good Job. Anyway, I'd like to give you a few comments:

1. I really think you should create a thread in HOW-TO category with your tutorial/script because anyone will easily get confused following this thread. What do you think?

2. Comparing packetloss between 2 different IPs with different protocols (TCP, UDP) is not that good idea. At your above example, it showed sharktech had 0% packetloss while fdc-ircnetwork had 3%. That is quite non-logical, unless fdc's switches were dropping packets (something very rare) or that ircnetworkbox was too busy/overloaded/attacked or my theory is that it may had to do with packets prioritization due to different protocols. So I'd recommend to perform tests using the same protocol, either TCP either UDP.

3. Although we have our own internal network topology (firewalls, switches, router) in sharktech, we still are passing through FDC's core-router so comparing us with FDC won't make any real difference unless there are DDoS attacks coming. In that case, 2 attacked servers (one in fdc and one in sharktech) will have huge difference in packetloss/downtime because the one will be firewalled while the other unfirewalled.

4., A verizon IP (151.202.67.XXX) that keeps trying to connect/scan closed ports on our server(s) every 5 minutes since yesterday is yours? Since I blocked it, it's hammering us every 1-2 seconds (all the time, not every 5 minutes) which is quite unfriendly and may be caused due to the high timeout (10 secs if I'm correct) you've setted on your script. The reason I'm mentioning this is not to blame you about something, but maybe to improve the script to not hammer if someone blocks it. Also, I have to admit that I don't really like unauthorized port scanning/monitoring so I'd appreciate if it's yours to stop it. However, if that IP is not related to you, please nevermind.

Once again, good job and special thanks for your valuable help on this forum.


mikron15, bummer has already said that we'll be moved in a different router at 22-23rd of this month that will be connected to multiple OC-192's. So I don't think there is any real reason to get in touch with L3 as there was no complete outage, but just the usual packetloss issues we have been facing since FDC moved from Williams to Level3.

Thanks, no how to maybe later. If someone doesn't know how to run this they should not be administring anything in first place and have to read other things instead of this how to.

FDCServers.net is cogent while sharktech is on Level3 packet loss can be different perhabs?

Yeah i was just using you as example for TCP ping, because you block icmp.

Hehe, ketle calling pot:

[19-12-2004 11:40] 60 packets transmitted, 0 packets received, 100% packet loss
[19-12-2004 11:41] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:41] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:43] 60 packets transmitted, 1 packets received, 98% packet loss
[19-12-2004 11:44] 60 packets transmitted, 0 packets received, 100% packet loss
[19-12-2004 11:45] 60 packets transmitted, 0 packets received, 100% packet loss

:D

Users can change time out on their own to easy up monitoring.

BTW Spike on cogent:

--
Mon Dec 20 11:45:00 EST 2004 Pinging (UDP) fdcservers.net:
30 packets transmitted, 15 packets received, 50% packet loss

psyxakias
12-20-2004, 17:03
Thanks, no how to maybe later. If someone doesn't know how to run this they should not be administring anything in first place and have to read other things instead of this how to.Although you're right, I never think like this because that way we shouldn't even help or get helped on these forums at all. ;)

FDCServers.net is cogent while sharktech is on Level3 packet loss can be different perhabs?FDC web segment is on Cogent/Level3 BGP mix, while IRC segment is on different Level3 line. However, sharktech also uses the L3 line that is on IRC segment.. so there shouldn't be much difference between FDC's IRC segment & sharktech unless there are DDoS/switch issues as I explained on the previous post.

Yeah i was just using you as example for TCP ping, because you block icmp.I see, okay although as I said.. I didn't really appreciate unauthorized port scanning/monitoring/hammering to our web server. ;)

Rizzon
12-20-2004, 17:23
Sorry :( :p

psyxakias
12-20-2004, 17:44
sorry? come on.. I believe I even gave you a new idea, on your next script's version to have a dst-port parameter (other than default 65535) ;)

Keep up the good work, hehehe :cool:

Rizzon
12-20-2004, 22:47
9. 4.79.72.42 40.0% 5 201.6 203.0 201.1 206.3 2.9
4.79.72.46
10. 209.120.155.14 25.0% 5 212.0 206.3 198.8 212.0 6.8


Packet loss again.. not on L3 side... :rolleyes:

mikron15
01-23-2005, 23:43
[/QUOTE]

hey Rizon, i installed poink
It doesnt seem to work.

ping yahoo.ca
Nosuid TCP/IP ping 1.6 by <lcamtuf@coredump.cx>
Pinging yahoo.ca (66.218.71.198) - delay 1 sec(s), timeout 4 sec(s).
No ping reply from 66.218.71.198 within 4 second(s)...
No ping reply from 66.218.71.198 within 4 second(s)...
No ping reply from 66.218.71.198 within 4 second(s)...

-- 66.218.71.198 ping statistics --
4 packet(s) transmitted, 0 packet(s) received, 100% packets lost.
round-trip statistics min/avg/max: (not available due to 100% packets lost).
root@ruby [/var/log]# ping fdcservers.net
Nosuid TCP/IP ping 1.6 by <lcamtuf@coredump.cx>
Pinging fdcservers.net (66.90.66.135) - delay 1 sec(s), timeout 4 sec(s).
No ping reply from 66.90.66.135 within 4 second(s)...
No ping reply from 66.90.66.135 within 4 second(s)...
No ping reply from 66.90.66.135 within 4 second(s)...

-- 66.90.66.135 ping statistics --
4 packet(s) transmitted, 0 packet(s) received, 100% packets lost.
round-trip statistics min/avg/max: (not available due to 100% packets lost).


Is there any way to fix this or how to uninstall it and get my original ping back?